An Evergreen nonprofit foundation became the victim of a common form of corporate identity theft after a member of the board of directors altered the foundation's listing on the secretary of state's website.

The Rocky Mountain Academy of Evergreen Foundation, like dozens of entities in Colorado and elsewhere, was unwittingly victimized by a flaw in the online process that takes advantage of a third party's ability to change information on the secretary of state's website without using a password.

Since the 2009 incident, the foundation, which raises money for school building projects, has put in place new procedures on how checks are handled, according to Jim Petterson, a member of the foundation’s board.

Rocky Mountain Academy of Evergreen is a public charter school sanctioned by the Jefferson County Public School District.

The foundation has signed up for e-mail notification reflecting any attempt by any party to change information in the secretary of state's online database. It also installed a lockbox in the school's main office where parents can leave donations.

Roland Thomas Luce, 52, of Littleton, a former member of the foundation’s board, took $3,250 from the foundation bank account, according to the Jefferson County Sheriff’s Office.

Luce pleaded guilty June 14 to one count of identity theft and one count of second-degree forgery. He received a deferred judgment for two years and two years' probation. A deferred judgment means the defendant is put on probation, and if he complies with all the conditions, the guilty plea is withdrawn, the case is dismissed and no conviction enters the record.

Luce had no previous criminal history and has returned all the money to the foundation.

"The 2009 theft of Foundation money was an incident that angered and shocked all of us on the Foundation board. A person placed in a position of trust violated that trust and attempted to steal money donated by parents for the benefit of the students and teachers at RMAE," Petterson said in an e-mail to the Canyon Courier.

"Upon learning of the theft, the foundation board reported the crime to the Jefferson County Sheriff's Office. After conferring with the JCSO investigator, the board demanded that Mr. Luce resign … . Foundation board members next personally reached out to donor families to alert them to the incident and to encourage them to monitor their own accounts and report any irregularities. Thankfully, no further problems were reported to the Foundation," Petterson says.

School district not notified

At the time of the discovery of the theft a year ago, the foundation board failed to notify the school district. The district found out about the theft a few weeks ago from the Canyon Courier.

"Members of the foundation’s board of directors have apologized for that oversight and have assured the district that they will strengthen the lines of communication in the future," said Lynn Setzer, chief spokeswoman for Jefferson County Public Schools.

Petterson said the foundation is a nonprofit entity and wasn't under any under formal obligation to notify the school district, but should have done so as a courtesy.

"The RMAE Foundation is a private 501(c)3 nonprofit organization created to support the needs of the RMAE community. The foundation is distinct and separate from Rocky Mountain Academy of Evergreen, a tuition-free charter school. The foundation receives contributions only from private entities and receives no public funds. The foundation was not required to notify the Jeffco School District. However, in hindsight, a foundation representative as a courtesy should have alerted school district officials about the theft," Petterson said in an e-mail.

An ongoing threat

This form of identity theft, while illegal, is still possible, according to Brian Gryth, legislative and legal analyst with the business and licensing division of the secretary of state's office.

The only protection is to sign up for e-mail notification to alert an organization’s officials if anyone makes a change to the public record.

"We strongly encourage people to sign up for e-mail notification. It can be done from the website," Gryth said. "Look up the record and look at the menu of options on the bottom."

The office is also looking at implementing password or PIN protection but so far hasn't found an effective process. "Implementation is difficult," Gryth said. "It is just a lot of different steps to be sure it would actually protect people."

Sheriff's Investigator Terri Naes explained that Luce changed the name of the registered agent to his name and then opened a second account in the name of the Rocky Mountain Academy of Evergreen Foundation. Separately, he also tried to forge a couple of checks on the foundation's account.

Luce identified himself to the Canyon Courier as a business management consultant who owns a company that performs business management advisory services.

When money came in from donations for the school's expansion project, he deposited the checks into the second account and then accessed the money electronically.

Luce returned the money before he met with the sheriff's investigator. "The president (of the board) found the two forged checks and then found the changes at the website, and that he had two accounts," Naes said.

"It's pretty easy to make these changes," Naes said. There is a small e-filing charge.

According to the Sheriff's Office, Luce paid back the missing money as soon as authorities found out about the suspected forgery and asked for an interview.

The county filed the criminal complaint against Luce on Dec. 11, 2009, charging him with identity theft, theft and forgery.

"The bottom line was he thought he could get away with it. His words were, he could make this whole before anybody knew about it," Naes said.

Once the authorities contacted him, Luce "basically laid it all out. He took full responsibility for what he did," Naes said.

Luce had no criminal history, but he was having some financial problems, Naes said.